Describe your situation FR

Service family

Sovereign AI and security

Some data must not leave your organization. And an exposed AI system must be tested like any other application. And agents connected to your tools must be inventoried before they act. These three services meet those requirements.

A sovereign AI stack, tested against attacks On your premises or in a Canadian cloud: applications, AI gateway, local model and an index of your documents, on infrastructure you control, with an audit log covering every layer. Penetration tests target the gateway with known attacks. An external model is called only if authorized, with filtered data. YOUR SITE OR A CANADIAN CLOUD Applicationsassistant, agents, integrations AI gatewaypermissions, routing, filtering Local modelopen model Indexyour documents Infrastructureservers you control Audit logcovers every layer Penetration testsknown attacks(OWASP LLM) External modelif authorized,filtered data
Sensitive data stays inside your perimeter, and protection is verified by testing, not assumed.

Private AI hosted on your premises

Who it's for

Organizations whose data must not leave their infrastructure: client files, health information, trade secrets, contracts.

Typical problem

“We'd like to use AI on our documents, but sending them to a vendor abroad is out of the question.”

What we do

  • Selection of open models suited to your uses and your hardware.
  • Installation on your servers, or in a Canadian cloud that you control.
  • Access gateway: authentication, permissions, routing, audit log.
  • Assistant for your documents that respects existing access rights.

Deliverables

  • Private AI platform, installed and documented.
  • Usable audit log.
  • Administration guide.
  • Knowledge transfer to your IT team.

Proof

L1 — Measured sovereign RAG, L2 — Enterprise AI gateway and the project Private AI (AI Trust Platform).

AI systems security

Who it's for

Organizations that expose an AI assistant, agent or API to staff, customers or partners.

Typical problem

“Our assistant has been online for three months. We don't know whether someone could get it to reveal internal data.”

What we do

  • Architecture review against the OWASP Top 10 for LLM Applications: prompt injection, data leakage, overly permissive agents, etc.
  • Targeted penetration tests of your AI applications, only with written authorization and a signed scope.
  • Prioritized recommendations and support with fixes.
  • Retesting after remediation.

Deliverables

  • Test report, with findings ranked by severity.
  • Prioritized remediation plan.
  • Retest report.

Proof

L6 — Penetration testing our own AI applications, and NB-TECH SHIELD, our security framework applied to our own systems.

No test is performed without written authorization specifying the scope, dates, permitted methods and contact persons.

Security of AI agents and MCP servers

Who it's for

Organizations deploying AI agents (Copilot Studio, coding assistants, automations) and MCP servers: information security, architecture, development and automation teams.

Typical problem

“Our teams are connecting agents and MCP servers to email, the CRM and code repositories. Nobody has a list of what they can read, send or delete.”

What we do

  • Inventory of agents, MCP servers and exposed tools: who can do what, with which data.
  • Offline analysis of the configurations you provide: MCP configurations, automation exports, tool manifests, environment variable names, never their values.
  • Detection of plaintext secrets (never reproduced), exposed transports and unpinned versions.
  • Identification of tools with effects (sending, payment, writing, commands) without human approval, of tool poisoning, and of the risky combination of untrusted content, action tools and access to secrets.
  • Verification of logging and the emergency stop.

Deliverables

  • Scored bilingual report: executive summary and technical appendix.
  • Findings mapped to the OWASP Top 10 for LLM Applications, OWASP Agentic AI, MITRE ATLAS, the NIST AI RMF, ISO/IEC 42001 and Law 25.
  • Prioritized remediation plan.
  • Revalidation after remediation.

Proof

The self-audit of NB-TECH's own agents and MCP servers is our reference case. L3 — Agent connected to office tools via MCP, with no more access than necessary, and NB-TECH SHIELD, whose audit tool for agents and MCP servers has been tested on fictitious datasets.

The audit is passive: it starts with written authorization specifying the scope, covers the configuration files your teams provide, and is performed offline, with no connection to your systems.

Other service families

Let's talk about your situation

Every organization has its own systems, data and constraints. We always start by understanding your situation. Scope and investment are then proposed in writing.

Describe your situationSee our approach